How to configure Sitecore to work with HTTPS

Question

I'm getting ready to move my Sitecore 8.1 instance from HTTP to HTTPS. Since we have a distributed environment, my networking team has the idea of just using the Load Balancer to serve HTTPS content to the web, while keeping the internal domain at HTTP.

I've read some articles by Brian Pedersen and Anders Laub that give some steps that need to be done to run Sitecore in SSL, but what if I just want to run the CD Server in SSL? Can the CD Servers run in SSL and not the CM/Processing and Aggregation/Reporting servers?

For us, this is an issue of maintaining the SSL certificates in 1 place instead of 7+ servers.

Answer 1

I just use IIS rewriting module to keep my CD servers in HTTPS.

You do need to take care if you use any 301 redirect modules. Since the IIS rules run before the Sitecore 301 redirect modules, your rules need to be prepared for https urls.

<rewrite>
  <rules>
    <rule name="HTTP to HTTPS redirect" stopProcessing="true">
      <match url="(.*)" />
      <conditions>
        <add input="{HTTPS}" pattern="off" ignoreCase="true" />
      </conditions>
      <action type="Redirect" redirectType="Found" url="https://{HTTP_HOST}/{R:1}" />
    </rule>
  </rules>
</rewrite>

Answer 2

Since you're going to be terminating the SSL at the load balancer you won't be able to see the HTTPS condition on the web servers. You'll need to setup the load balancer to forward the protocol (HTTP_X_FORWARDED_PROTO) and check that otherwise you'll end up in an endless loop. Since as far as the CDs are concerned all traffic is coming in over port 80.

<rewrite>
    <rules>
        <rule name="HTTP to HTTPS redirect" stopProcessing="true">
            <match url="(.*)" />
            <conditions>
                <add input="{HTTP_X_FORWARDED_PROTO}" pattern="https" negate="true" />
            </conditions>
            <action type="Redirect" redirectType="Found" url="https://{HTTP_HOST}/{R:1}" />
        </rule>
    </rules>
</rewrite>

Answer 3

Handle BeginRequest event in Global.asax. This worked for me as rewrite module was absent on server.

protected void Application_BeginRequest(object sender, EventArgs e)
{                
    switch (Request.Url.Scheme)
    {
        case "https":
            Response.AppendHeader("Strict-Transport-Security", "max-age=31536000");
            break;
        case "http":
            var path = "https://" + Request.Url.Host + Request.Url.PathAndQuery;
            Response.Status = "301 Moved Permanently";
            Response.AddHeader("Location", path);
            break;
    }
}